Triggered me to do a quick check:
Their privacy policy looks alright; and while I don’t like ads, they are gone in the minimum donation package of just 1 EUR, I think I did that just shortly after I started using them. https://www.lonelycatgames.com/docs/xplore/privacy - all the other parts seem privacy respecting, and the company is based in Slovakia, so has to respect GDPR by default. Website looks very dated and some of the other software has been abandoned a while ago, but they clearly state that and offer it as-is. Funny enough, I’ve also been using Disk Map for ages and never realized it’s from the same developer.
Yeah it does. Adobe has a lot of active script support, including java script for example, which can be exploited. If a software can’t interpret those scripts at all and simply displays plain text, that means malware won’t be executed.
And since Adobe Acrobat / Acrobat Reader are the most common pdf viewers out there, they are a natural target for hackers as well.
Woah, I never knew Hypatia is part of the Divest team. Here I thought I was unaffected by the shutdown… I wonder if they’ll keep the av updates coming, since they are provided by ClamAV.
Edit: Looks like the script that converts clamav to hypatia compatible packages is public, I’m tempted to run it myself and host the files on my own server. That way I can just set the database override link within the app to my domain and done.
https://codeberg.org/divested-mobile/hypatia/src/branch/stable/scripts/Main.java
You can bypass this crap, but you’ll need to root your phone to achieve that.
Afterwards you’ll need to install magisk (superuser app) and a bunch of plugins: play integrity fix and playcurl_next (to simulate that your phone is unrooted), and then FlagSecurePatcher (which is the actual module that’s overriding the screenshot block.
My primary use case was magisk to enable taking screenshots from otherwise protected apps. Was living in China for almost 7 years, and even though I speak it quite alright, reading is a whole other level. And there are quite a few apps there that I had to use on a regular basis that had this damned flag_secure enabled so I couldn’t otherwise take screenshots to run them through a translation app.
The second one was system level adblock, since the alternative is for adblockers to install themselves as local VPNs routing traffic to 127.0.0.1; however being in China meant I actually had to use a real VPN to access the free internet, and I certainly didn’t want to choose between ads or privacy. The latter still applies; I’m using a VPN on most days.
Lastly, being able to use magisk also gives me access to some advanced security apps such as Hibernator (freezes apps, meaning they are basically uninstalled and reactivated on press, so they can’t use data, don’t get updated etc.), Storage Isolation (lets you configure on a per-app basis which folders it might access), App Ops (advanced permission management, which also includes an ignore function that acts like as if a certain permission was granted, but would feed random data or zeros to the app).
Being able to uninstall everything including system apps is also nice, though that can still be achieved with adb. Browsing root folders when looking for specific data is also nice, but I used that twice in about 5 years, so it’s probably not essential.
With playcurl next I didn’t experience any issues yet, it’s polling a new device fingerprint every couple minutes to make sure your device never ends up on a blocklist, and you can trigger this manually in the magisk app as well.
Can’t guarantee it’s never going to be blocked if Google changes the algorithm, but that would just mean they have to adjust the fingerprinting as well.
Nah you can easily bypass play integrity on a rooted phone, see my comment above.
With a rooted phone you can install Zygisk (magisk + zygote) and then a bunch of modules that simulate system integrity.
What you need are “play integrity fix” and “playcurl_NEXT”.
The first module lets you bypass the google play integrity check, the second one will download updated integrity fingerprint files every 5 minutes to ensure that the bypass never fails.
If you know how to install custom ROMs, this part is not a big challenge.
Most developers who publish on third party stores push all updates at the same time, then it really depends who’s quicker in the approval process.
If the dev is on github, that might be the fastest (below the overview section under ‘assets’).